CS Money

CS Money 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 身份认证5
• 业务逻辑4
• 访问控制3
• 拒绝服务3
• 信息泄露2
• 不安全的直接对象引用1
• 注入与走私1
• 跨站请求伪造1
• 其他弱点1
• SQL 注入1
• 跨站脚本1

主要弱点

• 认证缺陷（通用）3
• Unlabeled2
• 资源消耗失控2
• Reliance on Cookies without Validation and Integrity Checking in a Security Decision2
• 拒绝服务1
• Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)1
• 授权不当1
• IDOR1
• 隐私侵犯1
• SQL 注入1

常见资产

• 3d.cs.moneyURL · 7
• cs.moneyURL · 6
• support.cs.moneyURL · 5
• · 2
• old.cs.moneyURL · 2
• wiki.cs.moneyURL · 1

高票报告

当前状态 23 份 · 全部 23

1. 450
   Blind XSS on image upload跨站脚本 · 2020-12-26 · 严重
   $1,000存储型 XSS
2. 357
   [cs.money] Open Redirect Leads to Account Takeover身份认证 · 2020-09-30 · 中危
   $0认证缺陷（通用）
3. 127
   IDOR in https://3d.cs.money/不安全的直接对象引用 · 2020-09-28 · 中危
   $0IDOR
4. 77
   Html injection on subscription email注入与走私 · 2024-01-24 · 中危
   $300Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
5. 74
   Authentication Bypass to (CVE-2023-2982)身份认证 · 2023-12-08 · 低危
   $100Authentication Bypass Using an Alternate Path or Channel
6. 74
   Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamid访问控制 · 2020-12-20 · 严重
   $0Reliance on Cookies without Validation and Integrity Checking in a Security Decision
7. 70
   Able to blocking users with 2fa from login into their accounts by just knowing the SteamID访问控制 · 2023-12-15 · 中危
   $300Reliance on Cookies without Validation and Integrity Checking in a Security Decision
8. 66
   Attacker can generate cancelled transctions in a user's transaction history using only Steam ID访问控制 · 2021-02-03 · 中危
   $300授权不当
9. 48
   Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription业务逻辑 · 2020-09-28 · 中危
   $0Unlabeled
10. 36
    Application DOS via specially crafted payload on 3d.cs.money其他弱点 · 2020-10-01 · 中危
    $0Unlabeled
11. 33
    Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)跨站请求伪造 · 2020-10-28 · 中危
    $300跨站请求伪造
12. 30
    Cookie poisoning leads to DOS and Privacy Violation信息泄露 · 2021-02-25 · 高危
    $700隐私侵犯
13. 28
    Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable信息泄露 · 2020-11-12 · 低危
    $0User Interface (UI) Misrepresentation of Critical Information
14. 28
    Bypass Filter on link of build业务逻辑 · 2020-09-28 · 低危
    $0Unlabeled
15. 26
    Pixel Flood Attack leads to Application level DoS拒绝服务 · 2020-11-05 · 低危
    $200资源消耗失控
16. 23
    Blind Based SQL Injection in 3d.sc.moneySQL 注入 · 2021-04-16 · 未评级
    $0SQL 注入
17. 16
    Server-side denial of service via large payload sent to wiki.cs.money/graphql拒绝服务 · — · 未评级
    $0拒绝服务
18. 15
    ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)拒绝服务 · 2020-10-28 · 中危
    $250资源消耗失控
19. 11
    Origin IP found, Cloudflare bypassed业务逻辑 · 2021-03-30 · 中危
    $0违反安全设计原则（按标题归类）
20. 10
    Previously created sessions continue being valid after MFA activation身份认证 · 2021-05-19 · 中危
    $0Unlabeled
21. 9
    Manipulate Uneditable Messages in Support业务逻辑 · 2020-10-28 · 高危
    $0业务逻辑错误
22. 5
    Able to upload backgrounds before entering 2FA身份认证 · 2021-02-03 · 中危
    $0认证缺陷（通用）
23. 3
    Improper authentication in the load sell inventory page身份认证 · 2020-10-08 · 未评级
    $0认证缺陷（通用）